Certificate Transparency search for AI assistants and agents: subdomains, TLS certificates, organizations and certificate authorities, over the Model Context Protocol.
The address is https://mcp.ctlogs.dev/mcp (Streamable HTTP). It is a remote server: there is nothing to install, and it works at once without a key or an account. An assistant connected to it can answer questions such as “which subdomains does example.com have” or “who else holds a certificate for this name” from the public Certificate Transparency logs.
| Tool | What it does |
|---|---|
| find_subdomains | List the hostnames found under a domain in TLS certificates: one row per hostname with the number of certificates and first/last seen dates. |
| search_certificates | List TLS certificates issued for a domain name: id, matching names, issuer, serial number and validity dates. |
| search_organization | List TLS certificates whose subject organization matches a name, e.g. “PayPal, Inc.”: id, subject common name, domains, issuer and validity dates. |
| get_certificate | Return the full record of one certificate: subject, issuer, serial number, validity, DNS names, key and signature details, the CT log entries that recorded it and download URLs for the certificate body. |
| get_ca | Return one issuing CA certificate by its SHA-256 fingerprint (the issuer_ca field of get_certificate): subject, issuer, validity, parent and cross-signed certificates, the number of certificates it issued and a page of them. |
Claude Code:
claude mcp add --transport http ctlogs https://mcp.ctlogs.dev/mcp
With a key:
claude mcp add --transport http ctlogs https://mcp.ctlogs.dev/mcp --header "Authorization: Bearer YOUR_KEY"
claude.ai: under Customize › Connectors, choose Add, then Add custom connector, and enter the URL; under Authentication choose Sign in when needed. On Team and Enterprise plans an Owner adds it under Organization settings › Connectors.
ChatGPT: under Plugins, choose +, then Add custom MCP server, and enter the URL.
Cursor: in ~/.cursor/mcp.json, or .cursor/mcp.json in a project:
{
"mcpServers": {
"ctlogs": { "url": "https://mcp.ctlogs.dev/mcp" }
}
}
With a key:
{
"mcpServers": {
"ctlogs": {
"url": "https://mcp.ctlogs.dev/mcp",
"headers": { "Authorization": "Bearer YOUR_KEY" }
}
}
}
VS Code: in .vscode/mcp.json:
{
"servers": {
"ctlogs": { "type": "http", "url": "https://mcp.ctlogs.dev/mcp" }
}
}
With a key:
{
"servers": {
"ctlogs": {
"type": "http",
"url": "https://mcp.ctlogs.dev/mcp",
"headers": { "Authorization": "Bearer YOUR_KEY" }
}
}
}
The server works without an account up to the anonymous limits. When a call goes past them — the hourly allowance is used up, or a list is paged further than an anonymous caller may — an assistant that supports sign-in asks you to sign in: choose GitHub, Google or an e-mail link, allow the connection, and the assistant repeats the call on your account. A new account gets a free API key with 10,000 credits a month for testing and non-commercial use. Connected assistants are listed on the account page, where each can be disconnected. Clients where you set request headers yourself can send a key instead, as shown above.
A tool call is one API request and runs under the anonymous API’s limits, or the key’s plan (see limits); search_organization counts as 10, as /v1/org does. The key goes in the Authorization header only. Without a key or with a free key, a call that arrives while another is running waits up to 5 seconds for its turn. Certificate lists return 25 rows per call, limit up to 100; find_subdomains returns up to 100 hostnames per call. A list with more rows returns next_cursor for the next call.
A free key comes from the account page. The same searches are available as a REST API.